94.247.2.195

[spybotuser]

I have a website using statcounter on first page only. When I click on a page other than index.html while using NoScript I get a popup asking to allow or not 94.247.2.195
I did a search of all my web pages and no results for 94.247.2.195
Web page is hosted by 1and1, I use advast 4.8 and ran malwarebytes last night which found below which I removed.

Malwarebytes' Anti-Malware 1.35
Database version: 1904
Windows 5.1.2600 Service Pack 3

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

When I click on other sites I am not asked about allowing 94.247.2.195
I ran Spybot and nothing turned up for 94.247.2.195.

any suggestions?

[spybotuser]

I found this about 94.247.2.195

http://blog.scansafe.com/

and it was posted just a few days ago.

can you add this to spybot or what?

[Matt]

Hi spybotuser,

:welcome: to Safer Networking Forums. :)

Well, first of all, you scanned your computer with an old version of Malwarebytes' Anti-Malware (1.35). Moreover, your database (1904) is old too.

Up to date would be 1.36 and 1954 or higher.

Well, I've visited this site (94.247.2.195) and it was blocked by Firefox, because it is bad, that means, your computer can be infected with trojans and/or other Malware if you "walk" trough this site. I would not recommend you to go to this website. Moreover, it was good, that you have installed NoScript. ;)

Do you mean such a message (http://www.alterfalter.de/firefox-3-als-attackierend-gemeldete-website/)?

[tashi]

Hi there,


I did a search of all my web pages and no results for 94.247.2.195
That IP is in Latvia.


Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) ->


Update your security programs as Matt suggested, run scans and if that does not help please follow the procedure in this link:
"BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288)

Then start your own thread in the Malware Removal Forum (http://forums.spybot.info/forumdisplay.php?f=22) where an analyst will advise you as soon as available.

Regards. :)